I think that these methods should only add one single recipient, not more... (It would be a good protection from spam)

An easy way to correct the first problem should be by escaping (addcslashes()) the double-quote character (") with a backslash (\") when the recipient name needs to be quoted... This way the Cc header of the first example would be:
{{Cc: "Injected email\" injected.email@example.com, \"Normal email" email@example.com}}

For the second problem just checking for NO commas in the $email parameter should be ok.

Both these patches can be implemented within the method Zend_Mail::_addRecipientAndHeader().

Comments

Posted by old of Satoru Yoshida (yoshida@zend.co.jp) on 2009-01-03T01:07:27.000+0000

Solved in SVN r13498

make to change comma and double quote mark in mail address into question mark.

Posted by old of Satoru Yoshida (yoshida@zend.co.jp) on 2009-01-04T20:07:43.000+0000

I hear from Andrea Zilio that this issue rests some problem by email as following .

from here
What I wanted to say is that your svn commit (r13498) seems to solve only the second problem I've reported...
In fact running this code: